@vibesdotdev/forge 0.0.0-stage → 1.0.0-rc.5

package/dist/ci/cache-policy.d.ts

@@ -0,0 +1,181 @@
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+export declare const CiCacheRepositorySchema: z.ZodString;
+export declare const CiCacheNamespaceSchema: z.ZodString;
+export declare const CiCacheTaskHashSchema: z.ZodString;
+export declare const CiCacheBodyDigestSchema: z.ZodString;
+export declare const CiCacheCommitSchema: z.ZodString;
+/**
+ * Opaque task identity accepted by the policy input. Exported so the Forge
+ * Actions cache compiler and the typed cache plan reuse the exact rule instead
+ * of restating it.
+ */
+export declare const CiCacheTaskIdSchema: z.ZodString;
+/** Envelope `toolchain` identity: a bounded, non-empty label. */
+export declare const CiCacheToolchainSchema: z.ZodString;
+/** Runner platform / CPU architecture label participating in the task hash. */
+export declare const CiCachePlatformSchema: z.ZodString;
+export declare const CiCacheSensitivitySchema: z.ZodEnum<{
+    "public-reproducible": "public-reproducible";
+    "trusted-only": "trusted-only";
+    disabled: "disabled";
+}>;
+export type CiCacheSensitivity = z.infer<typeof CiCacheSensitivitySchema>;
+export declare const CiCacheTrustTierSchema: z.ZodEnum<{
+    "untrusted-pr": "untrusted-pr";
+    "trusted-branch": "trusted-branch";
+    "trusted-control-plane": "trusted-control-plane";
+}>;
+export type CiCacheTrustTier = z.infer<typeof CiCacheTrustTierSchema>;
+export declare const CiCacheMethodSchema: z.ZodEnum<{
+    read: "read";
+    publish: "publish";
+    "quarantine-write": "quarantine-write";
+}>;
+export type CiCacheMethod = z.infer<typeof CiCacheMethodSchema>;
+/**
+ * Author-owned cache inputs. This is deliberately separate from the effective
+ * policy: callers may declare intent, but they cannot grant themselves access
+ * to a less trusted tier.
+ */
+export declare const CiCacheTaskPolicyInputSchema: z.ZodObject<{
+    repository: z.ZodString;
+    taskId: z.ZodString;
+    namespace: z.ZodString;
+    declaredSensitivity: z.ZodOptional<z.ZodEnum<{
+        "public-reproducible": "public-reproducible";
+        "trusted-only": "trusted-only";
+        disabled: "disabled";
+    }>>;
+    credentialReferences: z.ZodDefault<z.ZodArray<z.ZodObject<{
+        source: z.ZodEnum<{
+            secret: "secret";
+            env: "env";
+        }>;
+        key: z.ZodString;
+    }, z.core.$strip>>>;
+    secretBindings: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    privileged: z.ZodDefault<z.ZodBoolean>;
+}, z.core.$strict>;
+export type CiCacheTaskPolicyInput = z.input<typeof CiCacheTaskPolicyInputSchema>;
+export interface CiCachePolicy {
+    repository: string;
+    taskId: string;
+    namespace: string;
+    declaredSensitivity?: CiCacheSensitivity;
+    effectiveSensitivity: CiCacheSensitivity;
+    reasons: readonly string[];
+    readTrustTiers: readonly CiCacheTrustTier[];
+    writeTrustTiers: readonly CiCacheTrustTier[];
+}
+export declare class CiCachePlanError extends CapabilityError {
+    readonly reasons: readonly string[];
+    constructor(reasons: readonly string[], options?: {
+        cause?: unknown;
+    });
+}
+/**
+ * Derive the fail-closed policy before a runner starts. Credential references,
+ * secret bindings, and privileged execution are policy facts, not labels that
+ * a PR-controlled command may omit from its own declaration.
+ */
+export declare function deriveCiCachePolicy(input: CiCacheTaskPolicyInput): CiCachePolicy;
+/** Short-lived, audience-bound authority minted by the trusted control plane. */
+export declare const CiCacheCapabilitySchema: z.ZodObject<{
+    audience: z.ZodLiteral<"turbo-cache">;
+    repository: z.ZodString;
+    runId: z.ZodString;
+    namespace: z.ZodString;
+    trustTier: z.ZodEnum<{
+        "untrusted-pr": "untrusted-pr";
+        "trusted-branch": "trusted-branch";
+        "trusted-control-plane": "trusted-control-plane";
+    }>;
+    sensitivity: z.ZodEnum<{
+        "public-reproducible": "public-reproducible";
+        "trusted-only": "trusted-only";
+        disabled: "disabled";
+    }>;
+    methods: z.ZodArray<z.ZodEnum<{
+        read: "read";
+        publish: "publish";
+        "quarantine-write": "quarantine-write";
+    }>>;
+    issuedAt: z.ZodNumber;
+    expiresAt: z.ZodNumber;
+}, z.core.$strip>;
+export type CiCacheCapability = z.infer<typeof CiCacheCapabilitySchema>;
+/**
+ * Build the capability claim a trusted control plane may sign. The method set
+ * is derived from the validated policy; callers cannot request a broader set.
+ */
+export declare function createCiCacheCapability(policy: CiCachePolicy, input: Pick<CiCacheCapability, 'runId' | 'trustTier' | 'issuedAt' | 'expiresAt'>): CiCacheCapability;
+/** Signed metadata stored beside every body. It binds identity and integrity. */
+export declare const CiCacheArtifactEnvelopeSchema: z.ZodObject<{
+    repository: z.ZodString;
+    namespace: z.ZodString;
+    taskHash: z.ZodString;
+    bodyDigest: z.ZodString;
+    producerCommit: z.ZodString;
+    toolchain: z.ZodString;
+    sensitivity: z.ZodEnum<{
+        "public-reproducible": "public-reproducible";
+        "trusted-only": "trusted-only";
+        disabled: "disabled";
+    }>;
+    trustTier: z.ZodEnum<{
+        "untrusted-pr": "untrusted-pr";
+        "trusted-branch": "trusted-branch";
+        "trusted-control-plane": "trusted-control-plane";
+    }>;
+    signatureAlgorithm: z.ZodLiteral<"ed25519">;
+    signature: z.ZodString;
+    createdAt: z.ZodISODateTime;
+    expiresAt: z.ZodOptional<z.ZodISODateTime>;
+}, z.core.$strip>;
+export type CiCacheArtifactEnvelope = z.infer<typeof CiCacheArtifactEnvelopeSchema>;
+export declare function authorizeCiCacheOperation(capability: CiCacheCapability, method: CiCacheMethod, nowSeconds?: number): void;
+export declare function cacheArtifactKey(input: {
+    mode: 'public' | 'quarantine';
+    repository: string;
+    namespace: string;
+    taskHash: string;
+    runId?: string;
+}): string;
+export declare function artifactSigningPayload(envelope: CiCacheArtifactEnvelope): string;
+export declare function validateCiCacheArtifact(envelope: CiCacheArtifactEnvelope, context: Pick<CiCacheCapability, 'repository' | 'namespace' | 'sensitivity' | 'trustTier'> & {
+    taskHash: string;
+    bodyDigest: string;
+}): CiCacheArtifactEnvelope;
+export declare function sha256Hex(bytes: ArrayBuffer | Uint8Array): Promise<string>;
+/** One declared key file's resolved content identity. */
+export interface CiCacheTaskKeyFile {
+    /** Repository-relative path as declared by the author. */
+    path: string;
+    /** SHA-256 hex digest of the file's bytes. */
+    digest: string;
+}
+export interface CiCacheTaskHashInput {
+    taskId: string;
+    namespace: string;
+    /** Toolchain identity, e.g. `bun-1.3.13/turbo-2.9.17`. */
+    toolchain: string;
+    /** Runner platform, e.g. `linux`. */
+    platform: string;
+    /** Runner CPU architecture, e.g. `x64`. */
+    arch: string;
+    /** Declared key files with their resolved content digests. */
+    keyFiles: readonly CiCacheTaskKeyFile[];
+}
+/**
+ * Canonical task hash — the cache-miss identity for one declared task.
+ *
+ * The hash covers the declared key files' content digests, toolchain,
+ * platform, arch, task id, and namespace. They are serialized as one
+ * canonical JSON document (fixed field order, key files sorted by path) and
+ * fed through `sha256Hex`, so a changed key file, toolchain, platform, or
+ * architecture yields a different taskHash while an unchanged set is stable
+ * across runs and machines.
+ */
+export declare function deriveCiCacheTaskHash(input: CiCacheTaskHashInput): Promise<string>;
+//# sourceMappingURL=cache-policy.d.ts.map

package/dist/ci/cache-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-policy.d.ts","sourceRoot":"","sources":["../../src/ci/cache-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAStD,eAAO,MAAM,uBAAuB,aAOlC,CAAC;AACH,eAAO,MAAM,sBAAsB,aASjC,CAAC;AAEH,eAAO,MAAM,qBAAqB,aAAqC,CAAC;AACxE,eAAO,MAAM,uBAAuB,aAAwB,CAAC;AAC7D,eAAO,MAAM,mBAAmB,aAAwC,CAAC;AAEzE;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,aAAoB,CAAC;AACrD,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,aAA6B,CAAC;AACjE,+EAA+E;AAC/E,eAAO,MAAM,qBAAqB,aAA4B,CAAC;AAE/D,eAAO,MAAM,wBAAwB;;;;EAA8D,CAAC;AACpG,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,wBAAwB,CAAC,CAAC;AAE1E,eAAO,MAAM,sBAAsB;;;;EAIjC,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC;AAEtE,eAAO,MAAM,mBAAmB;;;;EAAkD,CAAC;AACnF,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE;;;;GAIG;AACH,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;kBAU/B,CAAC;AACX,MAAM,MAAM,sBAAsB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAElF,MAAM,WAAW,aAAa;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,mBAAmB,CAAC,EAAE,kBAAkB,CAAC;IACzC,oBAAoB,EAAE,kBAAkB,CAAC;IACzC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,cAAc,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAC5C,eAAe,EAAE,SAAS,gBAAgB,EAAE,CAAC;CAC7C;AAED,qBAAa,gBAAiB,SAAQ,eAAe;IACpD,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;gBAExB,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE;CAUrE;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,sBAAsB,GAAG,aAAa,CAgChF;AAED,iFAAiF;AACjF,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;;;;;;;;iBA2BjC,CAAC;AACJ,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,uBAAuB,CAAC,CAAC;AAExE;;;GAGG;AACH,wBAAgB,uBAAuB,CACtC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,IAAI,CAAC,iBAAiB,EAAE,OAAO,GAAG,WAAW,GAAG,UAAU,GAAG,WAAW,CAAC,GAC9E,iBAAiB,CAwBnB;AAED,iFAAiF;AACjF,eAAO,MAAM,6BAA6B;;;;;;;;;;;;;;;;;;;;;iBAaxC,CAAC;AACH,MAAM,MAAM,uBAAuB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,6BAA6B,CAAC,CAAC;AAEpF,wBAAgB,yBAAyB,CACxC,UAAU,EAAE,iBAAiB,EAC7B,MAAM,EAAE,aAAa,EACrB,UAAU,SAAgC,GACxC,IAAI,CAqBN;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACvC,IAAI,EAAE,QAAQ,GAAG,YAAY,CAAC;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,MAAM,CAUT;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,uBAAuB,GAAG,MAAM,CAehF;AAED,wBAAgB,uBAAuB,CACtC,QAAQ,EAAE,uBAAuB,EACjC,OAAO,EAAE,IAAI,CAAC,iBAAiB,EAAE,YAAY,GAAG,WAAW,GAAG,aAAa,GAAG,WAAW,CAAC,GAAG;IAC5F,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;CACnB,GACC,uBAAuB,CAkBzB;AAED,wBAAsB,SAAS,CAAC,KAAK,EAAE,WAAW,GAAG,UAAU,GAAG,OAAO,CAAC,MAAM,CAAC,CAMhF;AAED,yDAAyD;AACzD,MAAM,WAAW,kBAAkB;IAClC,0DAA0D;IAC1D,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,oBAAoB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,qCAAqC;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,IAAI,EAAE,MAAM,CAAC;IACb,8DAA8D;IAC9D,QAAQ,EAAE,SAAS,kBAAkB,EAAE,CAAC;CACxC;AAED;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAyBxF"}

package/dist/ci/cache-policy.js

@@ -0,0 +1,289 @@
+import * as z from 'zod/v4';
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { CiCredentialReferenceSchema } from "./schemas.js";
+const SafeCacheIdSchema = z
+    .string()
+    .min(1)
+    .max(128)
+    .regex(/^[A-Za-z0-9][A-Za-z0-9._:-]*$/, 'expected an opaque cache identifier');
+export const CiCacheRepositorySchema = z
+    .string()
+    .min(1)
+    .max(128)
+    .regex(/^[a-z0-9][a-z0-9._-]*(?:\/[a-z0-9][a-z0-9._-]*)?$/, 'expected a normalized owner/repository identifier');
+export const CiCacheNamespaceSchema = z
+    .string()
+    .min(1)
+    .max(128)
+    .regex(/^[a-z0-9][a-z0-9._/-]*$/, 'expected a normalized cache namespace')
+    .refine((value) => !value.split('/').some((segment) => segment === '' || segment === '.' || segment === '..'), 'expected a normalized cache namespace');
+export const CiCacheTaskHashSchema = z.string().regex(/^[a-f0-9]{64}$/);
+export const CiCacheBodyDigestSchema = CiCacheTaskHashSchema;
+export const CiCacheCommitSchema = z.string().regex(/^[a-f0-9]{40,64}$/);
+/**
+ * Opaque task identity accepted by the policy input. Exported so the Forge
+ * Actions cache compiler and the typed cache plan reuse the exact rule instead
+ * of restating it.
+ */
+export const CiCacheTaskIdSchema = SafeCacheIdSchema;
+/** Envelope `toolchain` identity: a bounded, non-empty label. */
+export const CiCacheToolchainSchema = z.string().min(1).max(256);
+/** Runner platform / CPU architecture label participating in the task hash. */
+export const CiCachePlatformSchema = z.string().min(1).max(64);
+export const CiCacheSensitivitySchema = z.enum(['public-reproducible', 'trusted-only', 'disabled']);
+export const CiCacheTrustTierSchema = z.enum([
+    'untrusted-pr',
+    'trusted-branch',
+    'trusted-control-plane'
+]);
+export const CiCacheMethodSchema = z.enum(['read', 'quarantine-write', 'publish']);
+/**
+ * Author-owned cache inputs. This is deliberately separate from the effective
+ * policy: callers may declare intent, but they cannot grant themselves access
+ * to a less trusted tier.
+ */
+export const CiCacheTaskPolicyInputSchema = z
+    .object({
+    repository: CiCacheRepositorySchema,
+    taskId: SafeCacheIdSchema,
+    namespace: CiCacheNamespaceSchema,
+    declaredSensitivity: CiCacheSensitivitySchema.optional(),
+    credentialReferences: z.array(CiCredentialReferenceSchema).max(32).default([]),
+    secretBindings: z.array(SafeCacheIdSchema).max(32).default([]),
+    privileged: z.boolean().default(false)
+})
+    .strict();
+export class CiCachePlanError extends CapabilityError {
+    reasons;
+    constructor(reasons, options) {
+        const reason = reasons[0] ?? 'invalid-cache-policy';
+        super('cache policy rejected', 'INVALID_INPUT', {
+            reason,
+            cause: options?.cause
+        });
+        this.name = 'CiCachePlanError';
+        this.reasons = Object.freeze([...reasons]);
+        Object.defineProperty(this, 'code', { value: reason, writable: true, configurable: true });
+    }
+}
+/**
+ * Derive the fail-closed policy before a runner starts. Credential references,
+ * secret bindings, and privileged execution are policy facts, not labels that
+ * a PR-controlled command may omit from its own declaration.
+ */
+export function deriveCiCachePolicy(input) {
+    const parsed = CiCacheTaskPolicyInputSchema.parse(input);
+    const reasons = [];
+    if (!parsed.declaredSensitivity)
+        reasons.push('missing-classification');
+    if (parsed.credentialReferences.length > 0)
+        reasons.push('credential-reference');
+    if (parsed.secretBindings.length > 0)
+        reasons.push('secret-binding');
+    if (parsed.privileged)
+        reasons.push('privileged-runner');
+    if (parsed.declaredSensitivity === 'public-reproducible' && reasons.length > 0) {
+        throw new CiCachePlanError(reasons);
+    }
+    const effectiveSensitivity = parsed.declaredSensitivity ?? 'disabled';
+    const readTrustTiers = effectiveSensitivity === 'public-reproducible'
+        ? ['untrusted-pr', 'trusted-branch', 'trusted-control-plane']
+        : effectiveSensitivity === 'trusted-only'
+            ? ['trusted-branch', 'trusted-control-plane']
+            : [];
+    const writeTrustTiers = effectiveSensitivity === 'disabled' ? [] : ['trusted-branch', 'trusted-control-plane'];
+    return Object.freeze({
+        repository: parsed.repository,
+        taskId: parsed.taskId,
+        namespace: parsed.namespace,
+        declaredSensitivity: parsed.declaredSensitivity,
+        effectiveSensitivity,
+        reasons: Object.freeze(reasons),
+        readTrustTiers: Object.freeze(readTrustTiers),
+        writeTrustTiers: Object.freeze(writeTrustTiers)
+    });
+}
+/** Short-lived, audience-bound authority minted by the trusted control plane. */
+export const CiCacheCapabilitySchema = z
+    .object({
+    audience: z.literal('turbo-cache'),
+    repository: CiCacheRepositorySchema,
+    runId: SafeCacheIdSchema,
+    namespace: CiCacheNamespaceSchema,
+    trustTier: CiCacheTrustTierSchema,
+    sensitivity: CiCacheSensitivitySchema,
+    methods: z.array(CiCacheMethodSchema).min(1).max(3),
+    issuedAt: z.number().int().nonnegative(),
+    expiresAt: z.number().int().positive()
+})
+    .superRefine((capability, context) => {
+    if (capability.expiresAt <= capability.issuedAt) {
+        context.addIssue({
+            code: 'custom',
+            path: ['expiresAt'],
+            message: 'capability expiry must be after issuance'
+        });
+    }
+    if (new Set(capability.methods).size !== capability.methods.length) {
+        context.addIssue({
+            code: 'custom',
+            path: ['methods'],
+            message: 'capability methods must be unique'
+        });
+    }
+});
+/**
+ * Build the capability claim a trusted control plane may sign. The method set
+ * is derived from the validated policy; callers cannot request a broader set.
+ */
+export function createCiCacheCapability(policy, input) {
+    if (policy.effectiveSensitivity === 'disabled') {
+        throw new CiCachePlanError(['cache-disabled']);
+    }
+    if (!policy.readTrustTiers.includes(input.trustTier)) {
+        throw new CiCachePlanError(['trust-tier-not-authorized']);
+    }
+    const methods = ['read'];
+    if (input.trustTier === 'untrusted-pr') {
+        methods.push('quarantine-write');
+    }
+    else if (policy.writeTrustTiers.includes(input.trustTier)) {
+        methods.push('publish');
+    }
+    return CiCacheCapabilitySchema.parse({
+        audience: 'turbo-cache',
+        repository: policy.repository,
+        runId: input.runId,
+        namespace: policy.namespace,
+        trustTier: input.trustTier,
+        sensitivity: policy.effectiveSensitivity,
+        methods,
+        issuedAt: input.issuedAt,
+        expiresAt: input.expiresAt
+    });
+}
+/** Signed metadata stored beside every body. It binds identity and integrity. */
+export const CiCacheArtifactEnvelopeSchema = z.object({
+    repository: CiCacheRepositorySchema,
+    namespace: CiCacheNamespaceSchema,
+    taskHash: CiCacheTaskHashSchema,
+    bodyDigest: CiCacheBodyDigestSchema,
+    producerCommit: CiCacheCommitSchema,
+    toolchain: z.string().min(1).max(256),
+    sensitivity: CiCacheSensitivitySchema,
+    trustTier: CiCacheTrustTierSchema,
+    signatureAlgorithm: z.literal('ed25519'),
+    signature: z.string().regex(/^[A-Za-z0-9_-]{32,1024}$/),
+    createdAt: z.iso.datetime(),
+    expiresAt: z.iso.datetime().optional()
+});
+export function authorizeCiCacheOperation(capability, method, nowSeconds = Math.floor(Date.now() / 1000)) {
+    const parsed = CiCacheCapabilitySchema.parse(capability);
+    if (parsed.expiresAt <= nowSeconds || parsed.issuedAt > nowSeconds + 60) {
+        throw new CiCachePlanError(['expired-or-future-capability']);
+    }
+    if (method === 'publish' && parsed.trustTier === 'untrusted-pr') {
+        throw new CiCachePlanError(['untrusted-publish']);
+    }
+    if (!parsed.methods.includes(method)) {
+        throw new CiCachePlanError(['method-not-authorized']);
+    }
+    if (method === 'read' && parsed.sensitivity === 'disabled') {
+        throw new CiCachePlanError(['cache-disabled']);
+    }
+    if (method === 'read' &&
+        parsed.sensitivity === 'trusted-only' &&
+        parsed.trustTier === 'untrusted-pr') {
+        throw new CiCachePlanError(['untrusted-read-of-trusted-artifact']);
+    }
+}
+export function cacheArtifactKey(input) {
+    const repository = CiCacheRepositorySchema.parse(input.repository);
+    const namespace = CiCacheNamespaceSchema.parse(input.namespace);
+    const taskHash = CiCacheTaskHashSchema.parse(input.taskHash);
+    if (input.mode === 'quarantine') {
+        if (!input.runId)
+            throw new CiCachePlanError(['quarantine-run-required']);
+        const runId = SafeCacheIdSchema.parse(input.runId);
+        return `quarantine/${runId}/${repository}/${namespace}/${taskHash}`;
+    }
+    return `public/${repository}/${namespace}/${taskHash}`;
+}
+export function artifactSigningPayload(envelope) {
+    const parsed = CiCacheArtifactEnvelopeSchema.parse(envelope);
+    return JSON.stringify({
+        repository: parsed.repository,
+        namespace: parsed.namespace,
+        taskHash: parsed.taskHash,
+        bodyDigest: parsed.bodyDigest,
+        producerCommit: parsed.producerCommit,
+        toolchain: parsed.toolchain,
+        sensitivity: parsed.sensitivity,
+        trustTier: parsed.trustTier,
+        signatureAlgorithm: parsed.signatureAlgorithm,
+        createdAt: parsed.createdAt,
+        expiresAt: parsed.expiresAt ?? null
+    });
+}
+export function validateCiCacheArtifact(envelope, context) {
+    const parsed = CiCacheArtifactEnvelopeSchema.parse(envelope);
+    if (parsed.repository !== context.repository ||
+        parsed.namespace !== context.namespace ||
+        parsed.taskHash !== context.taskHash ||
+        parsed.bodyDigest !== context.bodyDigest ||
+        parsed.sensitivity !== context.sensitivity) {
+        throw new CiCachePlanError(['artifact-binding-mismatch']);
+    }
+    if (parsed.trustTier === 'untrusted-pr' && context.trustTier !== 'untrusted-pr') {
+        throw new CiCachePlanError(['artifact-trust-escalation']);
+    }
+    if (parsed.expiresAt && Date.parse(parsed.expiresAt) <= Date.now()) {
+        throw new CiCachePlanError(['expired-artifact']);
+    }
+    return parsed;
+}
+export async function sha256Hex(bytes) {
+    const input = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
+    const stableBuffer = new ArrayBuffer(input.byteLength);
+    new Uint8Array(stableBuffer).set(input);
+    const digest = await crypto.subtle.digest('SHA-256', stableBuffer);
+    return Array.from(new Uint8Array(digest), (byte) => byte.toString(16).padStart(2, '0')).join('');
+}
+/**
+ * Canonical task hash — the cache-miss identity for one declared task.
+ *
+ * The hash covers the declared key files' content digests, toolchain,
+ * platform, arch, task id, and namespace. They are serialized as one
+ * canonical JSON document (fixed field order, key files sorted by path) and
+ * fed through `sha256Hex`, so a changed key file, toolchain, platform, or
+ * architecture yields a different taskHash while an unchanged set is stable
+ * across runs and machines.
+ */
+export async function deriveCiCacheTaskHash(input) {
+    const taskId = CiCacheTaskIdSchema.parse(input.taskId);
+    const namespace = CiCacheNamespaceSchema.parse(input.namespace);
+    const toolchain = CiCacheToolchainSchema.parse(input.toolchain);
+    const platform = CiCachePlatformSchema.parse(input.platform);
+    const arch = CiCachePlatformSchema.parse(input.arch);
+    const seen = new Set();
+    const keyFiles = input.keyFiles
+        .map((file) => {
+        const path = z.string().min(1).max(240).parse(file.path);
+        const digest = CiCacheBodyDigestSchema.parse(file.digest);
+        if (seen.has(path))
+            throw new CiCachePlanError(['duplicate-key-file']);
+        seen.add(path);
+        return { path, digest };
+    })
+        .sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0));
+    const canonical = JSON.stringify({
+        arch,
+        keyFiles,
+        namespace,
+        platform,
+        taskId,
+        toolchain
+    });
+    return sha256Hex(new TextEncoder().encode(canonical));
+}
+//# sourceMappingURL=cache-policy.js.map

package/dist/ci/cache-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cache-policy.js","sourceRoot":"","sources":["../../src/ci/cache-policy.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,2BAA2B,EAAE,MAAM,cAAc,CAAC;AAE3D,MAAM,iBAAiB,GAAG,CAAC;KACzB,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,+BAA+B,EAAE,qCAAqC,CAAC,CAAC;AAEhF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACtC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CACL,mDAAmD,EACnD,mDAAmD,CACnD,CAAC;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC;KACrC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,GAAG,CAAC;KACR,KAAK,CAAC,yBAAyB,EAAE,uCAAuC,CAAC;KACzE,MAAM,CACN,CAAC,KAAK,EAAE,EAAE,CACT,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI,CAAC,EAC3F,uCAAuC,CACvC,CAAC;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;AACxE,MAAM,CAAC,MAAM,uBAAuB,GAAG,qBAAqB,CAAC;AAC7D,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC;AAEzE;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,iBAAiB,CAAC;AACrD,iEAAiE;AACjE,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACjE,+EAA+E;AAC/E,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAE/D,MAAM,CAAC,MAAM,wBAAwB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,qBAAqB,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC;AAGpG,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC,IAAI,CAAC;IAC5C,cAAc;IACd,gBAAgB;IAChB,uBAAuB;CACvB,CAAC,CAAC;AAGH,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAC;AAGnF;;;;GAIG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC;KAC3C,MAAM,CAAC;IACP,UAAU,EAAE,uBAAuB;IACnC,MAAM,EAAE,iBAAiB;IACzB,SAAS,EAAE,sBAAsB;IACjC,mBAAmB,EAAE,wBAAwB,CAAC,QAAQ,EAAE;IACxD,oBAAoB,EAAE,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9E,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D,UAAU,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;CACtC,CAAC;KACD,MAAM,EAAE,CAAC;AAcX,MAAM,OAAO,gBAAiB,SAAQ,eAAe;IAC3C,OAAO,CAAoB;IAEpC,YAAY,OAA0B,EAAE,OAA6B;QACpE,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,sBAAsB,CAAC;QACpD,KAAK,CAAC,uBAAuB,EAAE,eAAe,EAAE;YAC/C,MAAM;YACN,KAAK,EAAE,OAAO,EAAE,KAAK;SACrB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QAC3C,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5F,CAAC;CACD;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA6B;IAChE,MAAM,MAAM,GAAG,4BAA4B,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACzD,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,mBAAmB;QAAE,OAAO,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;IACxE,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;IACjF,IAAI,MAAM,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,UAAU;QAAE,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAEzD,IAAI,MAAM,CAAC,mBAAmB,KAAK,qBAAqB,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,oBAAoB,GAAG,MAAM,CAAC,mBAAmB,IAAI,UAAU,CAAC;IACtE,MAAM,cAAc,GACnB,oBAAoB,KAAK,qBAAqB;QAC7C,CAAC,CAAC,CAAC,cAAc,EAAE,gBAAgB,EAAE,uBAAuB,CAAC;QAC7D,CAAC,CAAC,oBAAoB,KAAK,cAAc;YACxC,CAAC,CAAC,CAAC,gBAAgB,EAAE,uBAAuB,CAAC;YAC7C,CAAC,CAAC,EAAE,CAAC;IACR,MAAM,eAAe,GACpB,oBAAoB,KAAK,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,gBAAgB,EAAE,uBAAuB,CAAC,CAAC;IAExF,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;QAC/C,oBAAoB;QACpB,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC;QAC/B,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC;QAC7C,eAAe,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC;KAC/C,CAAC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC;KACtC,MAAM,CAAC;IACP,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAClC,UAAU,EAAE,uBAAuB;IACnC,KAAK,EAAE,iBAAiB;IACxB,SAAS,EAAE,sBAAsB;IACjC,SAAS,EAAE,sBAAsB;IACjC,WAAW,EAAE,wBAAwB;IACrC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnD,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC;KACD,WAAW,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE;IACpC,IAAI,UAAU,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;QACjD,OAAO,CAAC,QAAQ,CAAC;YAChB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,WAAW,CAAC;YACnB,OAAO,EAAE,0CAA0C;SACnD,CAAC,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACpE,OAAO,CAAC,QAAQ,CAAC;YAChB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,CAAC,SAAS,CAAC;YACjB,OAAO,EAAE,mCAAmC;SAC5C,CAAC,CAAC;IACJ,CAAC;AACF,CAAC,CAAC,CAAC;AAGJ;;;GAGG;AACH,MAAM,UAAU,uBAAuB,CACtC,MAAqB,EACrB,KAAgF;IAEhF,IAAI,MAAM,CAAC,oBAAoB,KAAK,UAAU,EAAE,CAAC;QAChD,MAAM,IAAI,gBAAgB,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,gBAAgB,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,OAAO,GAAoB,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,uBAAuB,CAAC,KAAK,CAAC;QACpC,QAAQ,EAAE,aAAa;QACvB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,WAAW,EAAE,MAAM,CAAC,oBAAoB;QACxC,OAAO;QACP,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS;KAC1B,CAAC,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,CAAC,MAAM,CAAC;IACrD,UAAU,EAAE,uBAAuB;IACnC,SAAS,EAAE,sBAAsB;IACjC,QAAQ,EAAE,qBAAqB;IAC/B,UAAU,EAAE,uBAAuB;IACnC,cAAc,EAAE,mBAAmB;IACnC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC;IACrC,WAAW,EAAE,wBAAwB;IACrC,SAAS,EAAE,sBAAsB;IACjC,kBAAkB,EAAE,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;IACxC,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,0BAA0B,CAAC;IACvD,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE;IAC3B,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACtC,CAAC,CAAC;AAGH,MAAM,UAAU,yBAAyB,CACxC,UAA6B,EAC7B,MAAqB,EACrB,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;IAE1C,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACzD,IAAI,MAAM,CAAC,SAAS,IAAI,UAAU,IAAI,MAAM,CAAC,QAAQ,GAAG,UAAU,GAAG,EAAE,EAAE,CAAC;QACzE,MAAM,IAAI,gBAAgB,CAAC,CAAC,8BAA8B,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QACjE,MAAM,IAAI,gBAAgB,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,gBAAgB,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;QAC5D,MAAM,IAAI,gBAAgB,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC;IAChD,CAAC;IACD,IACC,MAAM,KAAK,MAAM;QACjB,MAAM,CAAC,WAAW,KAAK,cAAc;QACrC,MAAM,CAAC,SAAS,KAAK,cAAc,EAClC,CAAC;QACF,MAAM,IAAI,gBAAgB,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC;IACpE,CAAC;AACF,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,KAMhC;IACA,MAAM,UAAU,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;QACjC,IAAI,CAAC,KAAK,CAAC,KAAK;YAAE,MAAM,IAAI,gBAAgB,CAAC,CAAC,yBAAyB,CAAC,CAAC,CAAC;QAC1E,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACnD,OAAO,cAAc,KAAK,IAAI,UAAU,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,UAAU,UAAU,IAAI,SAAS,IAAI,QAAQ,EAAE,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,QAAiC;IACvE,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,OAAO,IAAI,CAAC,SAAS,CAAC;QACrB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;QAC7C,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI;KACnC,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,QAAiC,EACjC,OAGC;IAED,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,IACC,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QACxC,MAAM,CAAC,SAAS,KAAK,OAAO,CAAC,SAAS;QACtC,MAAM,CAAC,QAAQ,KAAK,OAAO,CAAC,QAAQ;QACpC,MAAM,CAAC,UAAU,KAAK,OAAO,CAAC,UAAU;QACxC,MAAM,CAAC,WAAW,KAAK,OAAO,CAAC,WAAW,EACzC,CAAC;QACF,MAAM,IAAI,gBAAgB,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,KAAK,cAAc,IAAI,OAAO,CAAC,SAAS,KAAK,cAAc,EAAE,CAAC;QACjF,MAAM,IAAI,gBAAgB,CAAC,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAC3D,CAAC;IACD,IAAI,MAAM,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACpE,MAAM,IAAI,gBAAgB,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,KAA+B;IAC9D,MAAM,KAAK,GAAG,KAAK,YAAY,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,IAAI,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACvD,IAAI,UAAU,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IACnE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAClG,CAAC;AAuBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAA2B;IACtE,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ;SAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE;QACb,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC;QACvE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IACzB,CAAC,CAAC;SACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACxF,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI;QACJ,QAAQ;QACR,SAAS;QACT,QAAQ;QACR,MAAM;QACN,SAAS;KACT,CAAC,CAAC;IACH,OAAO,SAAS,CAAC,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/ci/docs/ci.framework.docs.descriptor.d.ts

@@ -0,0 +1,4 @@
+import type { DocsTopicDescriptor } from '@vibesdotdev/docs-contracts';
+declare const descriptor: DocsTopicDescriptor;
+export default descriptor;
+//# sourceMappingURL=ci.framework.docs.descriptor.d.ts.map

package/dist/ci/docs/ci.framework.docs.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.framework.docs.descriptor.d.ts","sourceRoot":"","sources":["../../../src/ci/docs/ci.framework.docs.descriptor.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAEvE,QAAA,MAAM,UAAU,EAAE,mBA4BjB,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/ci/docs/ci.framework.docs.descriptor.js

@@ -0,0 +1,30 @@
+const descriptor = {
+    kind: 'docs/topic',
+    id: 'ci.framework',
+    title: 'CI Runtime Framework',
+    summary: 'Provider-agnostic pipeline, suite, runner, reporter, and artifact descriptors',
+    body: {
+        type: 'markdown',
+        sourceType: 'package',
+        source: 'package:@vibesdotdev/forge/ci:src/docs/ci.framework.md'
+    },
+    tags: ['ci', 'infra', 'runtime', 'pipelines'],
+    surfaces: ['cli', 'web', 'in-app'],
+    hardware: ['consumer', 'cloud'],
+    enabled: true,
+    man: {
+        name: 'ci.framework — CI runtime descriptors',
+        section: 1,
+        synopsis: 'vibes man ci.framework',
+        options: [],
+        examples: [
+            {
+                description: 'Author a pipeline descriptor',
+                command: 'createCiPipeline({ id: "my-ci", source, controlPlane, reporting, runners, suites })'
+            }
+        ],
+        seeAlso: ['infra-core', 'infra-deploy']
+    }
+};
+export default descriptor;
+//# sourceMappingURL=ci.framework.docs.descriptor.js.map

package/dist/ci/docs/ci.framework.docs.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.framework.docs.descriptor.js","sourceRoot":"","sources":["../../../src/ci/docs/ci.framework.docs.descriptor.ts"],"names":[],"mappings":"AAEA,MAAM,UAAU,GAAwB;IACvC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,cAAc;IAClB,KAAK,EAAE,sBAAsB;IAC7B,OAAO,EAAE,+EAA+E;IACxF,IAAI,EAAE;QACL,IAAI,EAAE,UAAU;QAChB,UAAU,EAAE,SAAS;QACrB,MAAM,EAAE,wDAAwD;KAChE;IACD,IAAI,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC;IAC7C,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC;IAClC,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,OAAO,EAAE,IAAI;IACb,GAAG,EAAE;QACJ,IAAI,EAAE,uCAAuC;QAC7C,OAAO,EAAE,CAAC;QACV,QAAQ,EAAE,wBAAwB;QAClC,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE;YACT;gBACC,WAAW,EAAE,8BAA8B;gBAC3C,OAAO,EACN,qFAAqF;aACtF;SACD;QACD,OAAO,EAAE,CAAC,YAAY,EAAE,cAAc,CAAC;KACvC;CACD,CAAC;AAEF,eAAe,UAAU,CAAC"}

package/dist/ci/executor/ci-executor.descriptor.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `ci/executor` descriptor (Forge CI executor contract).
+ *
+ * One registered implementation that can run a Forge CI attempt. Two exist: a
+ * disposable isolated sandbox and an enrolled fleet machine owned by the
+ * repository's owner. They are selected by the runtime, never by a branch in
+ * the queue consumer — a second selector beside the gateway is how the two
+ * paths drift, and it is exactly how the fleet path silently lost cancellation
+ * and release attestations.
+ *
+ * Kind id is CANON `ci/executor` only (MIGRATE folded the former
+ * `forge/ci-executor` schema here). `ForgeCi*` names remain as aliases for
+ * existing imports from `@vibesdotdev/forge/ci/executor`.
+ */
+export { CiExecutorDescriptorSchema, CiExecutorDescriptorSchema as ForgeCiExecutorDescriptorSchema, type CiExecutorDescriptor, type CiExecutorDescriptor as ForgeCiExecutorDescriptor, type CiExecutorDescriptorInput } from '../schemas.ts';
+//# sourceMappingURL=ci-executor.descriptor.d.ts.map

package/dist/ci/executor/ci-executor.descriptor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-executor.descriptor.d.ts","sourceRoot":"","sources":["../../../src/ci/executor/ci-executor.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACN,0BAA0B,EAC1B,0BAA0B,IAAI,+BAA+B,EAC7D,KAAK,oBAAoB,EACzB,KAAK,oBAAoB,IAAI,yBAAyB,EACtD,KAAK,yBAAyB,EAC9B,MAAM,eAAe,CAAC"}

package/dist/ci/executor/ci-executor.descriptor.js

@@ -0,0 +1,16 @@
+/**
+ * `ci/executor` descriptor (Forge CI executor contract).
+ *
+ * One registered implementation that can run a Forge CI attempt. Two exist: a
+ * disposable isolated sandbox and an enrolled fleet machine owned by the
+ * repository's owner. They are selected by the runtime, never by a branch in
+ * the queue consumer — a second selector beside the gateway is how the two
+ * paths drift, and it is exactly how the fleet path silently lost cancellation
+ * and release attestations.
+ *
+ * Kind id is CANON `ci/executor` only (MIGRATE folded the former
+ * `forge/ci-executor` schema here). `ForgeCi*` names remain as aliases for
+ * existing imports from `@vibesdotdev/forge/ci/executor`.
+ */
+export { CiExecutorDescriptorSchema, CiExecutorDescriptorSchema as ForgeCiExecutorDescriptorSchema } from "../schemas.js";
+//# sourceMappingURL=ci-executor.descriptor.js.map

package/dist/ci/executor/ci-executor.descriptor.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-executor.descriptor.js","sourceRoot":"","sources":["../../../src/ci/executor/ci-executor.descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EACN,0BAA0B,EAC1B,0BAA0B,IAAI,+BAA+B,EAI7D,MAAM,eAAe,CAAC"}

package/dist/ci/executor/ci-executor.kind.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Transitional export name for the CANON `ci/executor` kind.
+ *
+ * Do NOT register a second kind id. `forgeCiExecutorKind` is the same object
+ * as `ciExecutorKind` (`id: 'ci/executor'`). Prefer importing `ciExecutorKind`
+ * from `@vibesdotdev/forge/ci` / `../kinds`.
+ */
+export { ciExecutorKind as forgeCiExecutorKind } from '../kinds/index.ts';
+export { ciExecutorKind as default } from '../kinds/index.ts';
+//# sourceMappingURL=ci-executor.kind.d.ts.map

package/dist/ci/executor/ci-executor.kind.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-executor.kind.d.ts","sourceRoot":"","sources":["../../../src/ci/executor/ci-executor.kind.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,IAAI,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,cAAc,IAAI,OAAO,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/ci/executor/ci-executor.kind.js

@@ -0,0 +1,10 @@
+/**
+ * Transitional export name for the CANON `ci/executor` kind.
+ *
+ * Do NOT register a second kind id. `forgeCiExecutorKind` is the same object
+ * as `ciExecutorKind` (`id: 'ci/executor'`). Prefer importing `ciExecutorKind`
+ * from `@vibesdotdev/forge/ci` / `../kinds`.
+ */
+export { ciExecutorKind as forgeCiExecutorKind } from "../kinds/index.js";
+export { ciExecutorKind as default } from "../kinds/index.js";
+//# sourceMappingURL=ci-executor.kind.js.map

package/dist/ci/executor/ci-executor.kind.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-executor.kind.js","sourceRoot":"","sources":["../../../src/ci/executor/ci-executor.kind.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,cAAc,IAAI,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC1E,OAAO,EAAE,cAAc,IAAI,OAAO,EAAE,MAAM,mBAAmB,CAAC"}

package/dist/ci/executor/index.d.ts

@@ -0,0 +1,5 @@
+export { ForgeCiExecutorDescriptorSchema, type ForgeCiExecutorDescriptor } from './ci-executor.descriptor.ts';
+export { forgeCiExecutorKind } from './ci-executor.kind.ts';
+export type { ForgeCiExecutorInterface, ForgeCiExecuteOptions } from './interface.ts';
+export { selectCiExecutorDescriptor, resolveCiExecutor, type ResolveCiExecutorOptions } from './resolve.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/ci/executor/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/ci/executor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,+BAA+B,EAC/B,KAAK,yBAAyB,EAC9B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACtF,OAAO,EACN,0BAA0B,EAC1B,iBAAiB,EACjB,KAAK,wBAAwB,EAC7B,MAAM,cAAc,CAAC"}

package/dist/ci/executor/index.js

@@ -0,0 +1,4 @@
+export { ForgeCiExecutorDescriptorSchema } from "./ci-executor.descriptor.js";
+export { forgeCiExecutorKind } from "./ci-executor.kind.js";
+export { selectCiExecutorDescriptor, resolveCiExecutor } from "./resolve.js";
+//# sourceMappingURL=index.js.map

package/dist/ci/executor/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/ci/executor/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,+BAA+B,EAE/B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAE5D,OAAO,EACN,0BAA0B,EAC1B,iBAAiB,EAEjB,MAAM,cAAc,CAAC"}